Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Python packages cleanup #30919

Merged
merged 26 commits into from Nov 6, 2017
Merged

Conversation

adisbladis
Copy link
Member

@adisbladis adisbladis commented Oct 29, 2017

Motivation for this change

pythonPackages is a mess and needs lots of cleanup and removal of unused unmaintained packages.
This is an attempt at starting the effort of cleaning things up.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

cc @domenkozar @bjornfor @lovek323 @nlewo @cillianderoiste

Copy link
Member

@FRidh FRidh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you cc the maintainers of the packages that are involved.

@@ -1,7 +1,12 @@
{stdenv, fetchurl, python27Packages, file }:
{ stdenv, fetchurl, python27Packages, file, pkgs }:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't use pypi2nix in 5666dff703372a9aaa0ec5fe03a2edd713f9f4ee.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did not use pypi2nix for any of this.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, I see. In any case, functions should preferably have exact arguments instead of package sets.

, pkgs }:

let
beautifulsoup = pythonPackages.callPackage ./beautifulsoup.nix {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Forgot to include this file?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I did. Will update.

Copy link
Contributor

@bjornfor bjornfor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bitstring isn't dead, it just needs URL update (and version bump).

UPDATE: Other non-dead packages (just need update): demjson, pyodbc, robotsuite.

@adisbladis
Copy link
Member Author

@bjornfor I know a bunch of the packages are not dead but since no one is maintaining them in nixpkgs I figure that they do more harm than good.

I started this by doing a git blame | grep sha256 and starting from the oldest packages.
This is all stuff that hasn't been updated since early 2014 and older.

I see no point in keeping around packages that no one has the intention of maintaining.

@adisbladis adisbladis force-pushed the pythonPackages-cleanup branch 2 times, most recently from c3407f4 to 0211bde Compare October 29, 2017 09:56
@bjornfor
Copy link
Contributor

I have updated bitstring, demjson, pyodbc, robotsuite in master (0b93dbe and parents). Please rebase.

Copy link
Contributor

@bjornfor bjornfor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated bitstring, demjson, pyodbc, robotsuite in master, so you can drop them from this PR.

@adisbladis
Copy link
Member Author

@bjornfor Please also split them out from python-packages.nix.

@bjornfor bjornfor dismissed their stale review October 29, 2017 10:50

No longer applies.

@bjornfor
Copy link
Contributor

@adisbladis: Done (489cdc2 and 3 parents).

@FRidh
Copy link
Member

FRidh commented Oct 29, 2017

Thank you @bjornfor

@adisbladis
Copy link
Member Author

@bjornfor Thanks :) Packages dropped from PR.

@bjornfor
Copy link
Contributor

@adisbladis:

@bjornfor I know a bunch of the packages are not dead but since no one is maintaining them in nixpkgs I figure that they do more harm than good.

Harm to whom? Nixpkgs users or maintainers?

@adisbladis
Copy link
Member Author

@bjornfor I have a few reasons for this.

  1. It's harmful to users. if I'm on the unstable channel I would expect to get the latest stable release of a given package, not something that is 3-7 years out of date.

  2. It's harmful for security. Lagging several years behind on security updates can never be a good thing.

  3. It's harmful for maintainers. A lot of the python packages are abandoned by their maintainer. You yourself is listed as a maintainer on 25 python packages, another maintainer with a bunch of abandoned packages are listed on 65 python packages. Can you honestly say that you are maintaining all of these?

  4. It's harmful to new contributors. I have on multiple occasions tried to improve and update packages with python dependencies and ended up giving up on the endeavour because it turns out every single dependency is horribly out of date. I'm pretty sure I'm not the only one.

@FRidh
Copy link
Member

FRidh commented Oct 29, 2017

@adisbladis I mostly agree with you, but I do want to add the following. Many of us that have been using Nixpkgs for some time are listed as maintainers for a lot of packages. That's mostly because we have (or had) a need for that package, and simply want to be warned when they are touched. Ideally, each of us would maintain fewer packages, but as is I think obvious, we just do not have that many maintainers, but still we have a need of the packages.

@adisbladis adisbladis force-pushed the pythonPackages-cleanup branch 2 times, most recently from 8885eb6 to 37f5dc0 Compare October 29, 2017 13:08
@bjornfor
Copy link
Contributor

@adisbladis:

  1. It's harmful to users. if I'm on the unstable channel I would expect to get the latest stable release of a given package, not something that is 3-7 years out of date.

The alternative is not having the package at all. (I'd rather have old package than no package.)

  1. It's harmful for security. Lagging several years behind on security updates can never be a good thing.

Good point.

  1. It's harmful for maintainers. A lot of the python packages are abandoned by their maintainer. You yourself is listed as a maintainer on 25 python packages, another maintainer with a bunch of abandoned packages are listed on 65 python packages. Can you honestly say that you are maintaining all of these?

(That doesn't explain how it's harmful to maintainers. I think it's harmful when there are packages that require maintenance, but nobody really cares about the packages anymore. Then it is better to remove, instead of "forcing" people to spend energy on things that don't matter.)

No, I cannot claim that I maintain all my packages, if that means always having the latest version (unfortunately). I could remove myself as maintainer and/or remove all "my" packages if they lack maintainers, but I don't see that as a good solution either.

  1. It's harmful to new contributors. I have on multiple occasions tried to improve and update packages with python dependencies and ended up giving up on the endeavour because it turns out every single dependency is horribly out of date. I'm pretty sure I'm not the only one.

But the alternative would be not having any dependency packages to begin with. Isn't it better to update a few old packages when needed than having to write all expressions from scratch?

To sum up, I think it's good that nixpkgs receives some "clean-up" from time to time (thanks!), but we must also find a balance in how eager we are when cleaning/removing stuff. Being too eager or too lazy is both bad.

@adisbladis
Copy link
Member Author

Since bpython is well underway in #30922 I have dropped it from the PR.

@@ -0,0 +1,25 @@
{ lib
, pkgs
, pythonPackages
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's better to have explicit dependencies, so please replace "pkgs" and "pythonPackages" with specific packages. (Unless there is a new style going on in nixpkgs python packaging that I've missed.)

@orivej
Copy link
Contributor

orivej commented Nov 7, 2017

I only noticed this PR when it was merged: it was not ready.

  1. This merge has broken the evaluation of master (for the purpose of nox-review and Travis, and hydra advancing the channel), fixed in pythonPackages.fuse: fix infinite recursion in expression #31340.

  2. RedNotebook is a diary application, its users will not be reconciled with its sudden removal, and its old version does not show its age and works perfectly well. I'm restoring and updating it in Restore and update RedNotebook #31341.

  3. I do not understand or appreciate this approach to packages (particularly applications) that build fine, and just were not updated in a few years. First, they may have satisfied users who did not notice anything lacking and do not care to update; or the old version may even work better than the new. Second, it is often easier to update existing packages than to add new ones. (For instance you've removed Task Coach 1.3.22 when the latest version is 1.4.3. I guess that it has not changed much, and that its old expression is useful to package the update.)

@FRidh
Copy link
Member

FRidh commented Nov 7, 2017

@orivej Ideally we have expressions, and preferably of the latest versions, but that requires maintainers. We just don't have enough people maintaining all of the expressions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants